SenegalLoi n° 2008-12 du 25 janvier 2008 sur la Protection des Données à Caractère Personnel, Commission des Données Personnelles et sanctions
In force.
An enforcement supervision rule binding public and private bodies.
- Enforcement body
- Commission de Protection des Données à Caractère Personnel (CDP)
- Obligation class
- Governance, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Cooperate with the CDP's on-site inspections and give its members or agents any document they need for their mission.
- Comply with a CDP warning or formal notice within the period it sets, or face suspension or definitive withdrawal of your processing authorization and a pecuniary fine of one million to one hundred million CFA francs.
- Expect the CDP to interrupt your processing, lock the data, or ban the processing without prior formal notice where it creates an urgent risk to rights and freedoms.
- Expect a violation of the Act to be prosecuted under the Penal Code and the cybercrime law, carrying imprisonment and fines as those instruments set.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
The Act's own art. 75 refers enforcement to the Penal Code and the cybercrime law; Loi n° 2008-11 sets a prison term of one to seven years and/or a fine of 500,000 to 10,000,000 CFA francs for most offenses against Loi n° 2008-12's processing duties (arts. 431-17 to 431-29 of the Penal Code as inserted), a lower tier of six months to five years and 300,000 to 5,000,000 CFA francs for negligent unlawful disclosure (art. 431-30, second paragraph), and conditions prosecution of an unlawful-disclosure offense on the victim's own complaint. Separately from that criminal exposure, the CDP itself may impose an administrative pecuniary fine of one million to one hundred million CFA francs where a controller does not comply with a formal notice (art. 30), after first provisionally or definitively withdrawing the controller's authorization.
Penalty structure
The one-to-seven-year, 500,000-to-10,000,000-franc tier covers most processing offenses inserted into the Penal Code by Loi n° 2008-11 (arts. 431-17 to 431-29) against Loi n° 2008-12's duties; a distinct lower tier (six months to five years, 300,000 to 5,000,000 francs) applies to negligent unlawful disclosure under art. 431-30's second paragraph, and a separate, smaller tier (six months to two years, 200,000 to 1,000,000 francs) punishes obstructing the CDP itself under art. 431-31, which is not a processing-duty offense. This figure is the criminal tier only: the CDP's own administrative pecuniary sanction under art. 30 of Loi n° 2008-12 runs one million to one hundred million CFA francs.
- Rule
- Fixed only
- As of
- Minimum
- 500,000
- Currency
- XOF
- Fixed cap
- 10,000,000
What it makes you log
Who may demand the log
Regulator
Logging duty
Articles 5 to 16 and 25 to 32 set up the Commission des Données Personnelles and give it powers to verify any processing, obtain copies of any useful document or medium (Article 16(2)(d)), enter business premises (Article 25), demand any document in any medium, take copies and access programs and data (Article 27), and to warn, order, withdraw an authorization, fine and suspend (Articles 29 to 31). Article 75 sends the offences to the Penal Code and the cybercrime law. These are a general power to demand and examine, not a duty on a controller to keep a log or record. The records the Law names in these articles are the Commission's own: the public register of processings it keeps (Article 16(4)), the minutes it draws up of verifications and visits (Article 28) and its annual report (Article 16(10)). The cited articles carry no scope clause.
- Kind
- None
- As of
What this law does
Article 5 creates the Commission de Protection des Données à Caractère Personnel, the CDP, as an independent administrative authority charged with ensuring processing complies with the Act, informing data subjects and controllers of their rights and duties, and checking that information and communication technologies do not threaten public freedoms or privacy.
Article 6 sets its eleven members, drawn from the Presidency, the National Assembly, the Senate, employer organizations, the Conseil d'Etat, the Cour de Cassation, the bar, human rights organizations, and the head of the State computing agency, appointed by decree, with a government commissioner who attends without voting.
Article 8 gives members a four year, once renewable term, bars removal except by resignation or an impediment the CDP itself finds, and binds them to professional secrecy, while article 12 gives them full immunity for opinions expressed in office and bars any authority from instructing them.
Article 16 lists the CDP's missions, including receiving declarations, complaints and petitions, referring offences to the public prosecutor without delay, ordering verifications, sanctioning a controller under articles 29 through 32, answering opinion requests, approving codes of conduct, keeping a public register of processing, advising controllers, authorizing cross border transfers, proposing legislative improvements, cooperating internationally, publishing its authorizations, and reporting annually to the President of the Republic and the President of the National Assembly.
Articles 25 through 27 let CDP members and sworn agents inspect premises used for processing, subject to a regional court's authorization if the occupant objects, and demand and copy any document useful to their mission, and article 28 requires an adversarial record of every inspection.
Article 29 lets the CDP warn a controller and give formal notice to end a breach within a set period, and article 30 lets it, after a contradictory procedure, provisionally or definitively withdraw an authorization and impose a pecuniary fine of one million to one hundred million CFA francs where the controller does not comply.
Article 31 lets the CDP, in an emergency threatening rights and freedoms, order the interruption of a processing operation, the locking of data, or a temporary or definitive ban on a processing that violates the Act, each after a contradictory procedure, and article 32 lets any CDP sanction or decision be appealed to the Conseil d'Etat. Article 75 refers violations of the Act to the Penal Code and the cybercrime law rather than setting its own criminal penalties.
Loi n° 2008-12 was promulgated on . It was published in Journal officiel n° 6406 of . The law's final articles state no day of its own for its entry into force.
Under article 2 of Loi n° 70-14 du 6 février 1970, a promulgated law that does not postpone its entry into force becomes executory on the third day after the Journal officiel issue carrying it is deposited at the General Secretariat in the Cap-Vert region and the communes of Diourbel, Kaolack, Saint-Louis and Thiès, and on the fifth day in the rest of the territory. Article 17 of Loi n° 2021-21 du 2 mars 2021 abrogates Loi n° 70-14, as modified by Loi n° 71-07 du 21 janvier 1971. No official record of the day on which the law became executory has been located.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .